2026

capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSuc

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that

Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoin

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metri

Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy confi

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopbac

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing informa

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig opti

Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalati

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attack

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attacke

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauth

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulti

The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization c

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_

Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows ap

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, whi

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER

Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization secur

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound

Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypa

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3,

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized at

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream wi

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted sequence of H.265

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream c

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a networ

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kes

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized atta

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an aut

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19,

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19,

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache